Correlate IOC lists against SIEM alerts and SOAR cases.
npx skills add https://github.com/dandye/ai-runbooks --skill correlate-ioc
Please help me install this Agent Skill. Skill: correlate-ioc Source: https://github.com/dandye/ai-runbooks/tree/main/skills/correlate-ioc Command: npx skills add https://github.com/dandye/ai-runbooks --skill correlate-ioc
This skill helps security teams rapidly determine if a given IOC has previously triggered alerts or is part of ongoing investigations by correlating IOC lists with SIEM and case data.
Query the system with an IOC list to retrieve related SIEM alerts and open cases.
High-intent search queries and answers about installing and using this skill.
Correlate IOCs across SIEM alerts and SOAR cases by querying SIEM and SOAR APIs with an IOC list and time frame, returning related alerts, open cases, correlation status, and malicious confidence levels.
Check if an IOC is part of an ongoing investigation by querying SOAR cases with a provided IOC list and case filter, which returns related cases and a correlation status flag indicating active observance.
Yes, you need SIEM and SOAR API access to correlate indicators of compromise, because the Skill queries these platforms directly to surface related alerts and cases for the provided IOC list.
Scope an incident response engagement using a list of IOCs by providing the list with a specified time frame in hours, which returns related SIEM alerts, related cases, and malicious confidence to guide the response.
IOC correlation summarizes related alerts for threat hunting by matching an IOC list against SIEM and SOAR data, returning contextual summaries of related alerts, cases, and a malicious confidence score.
Finding SIEM alerts related to a threat campaign requires an IOC list, a time frame in hours, and an optional SOAR case filter, returning correlated SIEM alerts, related cases, and correlation status.
Q16GAnalyze multi-source security logs to identify threat indicators and enable threat hunting.
zenobi-usCoordinate incident response for security breaches and operational incidents.
dandyeEnrich IOC indicators with GTI and Chronicle SIEM context to output threat findings and summaries.
FuzzdkkGenerate structured SOC alert triage steps and SIEM/EDR queries.
